Targeted Pentest

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/pensarai/apex/llms.txt

Use this file to discover all available pages before exploring further.

​

Overview

• Focused testing on specific targets
• Custom testing objectives per target
• Automatic PoC script generation
• Finding deduplication across runs
• Sandbox support for isolated execution
• Browser automation for complex testing scenarios

​

runTargetedPentestAgent

1. PLAN: State objectives and outline testing approach
2. VERIFY: Confirm target is reachable and understand baseline behavior
3. PREPARE: Research payloads and attack techniques
4. TEST: Execute targeted attacks methodically
5. EXPLOIT: Create proof-of-concept scripts
6. DOCUMENT: Document confirmed vulnerabilities
7. FINISH: Submit final summary

import { runTargetedPentestAgent } from '@pensar/apex/api/targetedPentest';

const result = await runTargetedPentestAgent({
  target: 'https://api.example.com/users',
  objectives: [
    'Test for SQL injection vulnerabilities',
    'Check for authentication bypass',
    'Test for broken access control',
  ],
  model: 'claude-sonnet-4-20250514',
  session: sessionInfo,
});

console.log(`Found ${result.findings.length} vulnerabilities`);

​

Parameters

​

Response

​

Usage Examples

import { runTargetedPentestAgent } from '@pensar/apex/api/targetedPentest';
import { createSession } from '@pensar/apex/session';

const session = await createSession({
  name: 'API Security Test',
  targets: ['https://api.example.com'],
});

const result = await runTargetedPentestAgent({
  target: 'https://api.example.com/users',
  objectives: [
    'Test for SQL injection in search parameter',
    'Check for broken access control on user updates',
  ],
  model: 'claude-sonnet-4-20250514',
  session,
});

console.log(`Found ${result.findings.length} vulnerabilities`);
result.findings.forEach((finding) => {
  console.log(`[${finding.severity}] ${finding.title}`);
  console.log(`  PoC: ${finding.pocPath}`);
});

​

Testing Guidelines

​

Writing Effective Objectives

• "Test SQL injection in username parameter on login endpoint"
• "Check for authentication bypass via JWT token manipulation"
• "Test for IDOR vulnerabilities on user profile update (PUT /api/users/:id)"
• "Test XSS in post content and comment fields"

• "Test the API" (too broad)
• "Find vulnerabilities" (not actionable)
• "Security test" (no specific target)

​

Available Testing Capabilities

• execute_command: Run shell commands (curl, custom scripts, exploit tools)
• http_request: Make HTTP requests with custom headers/body
• browser_navigate: Load pages in a headless browser
• browser_click: Interact with buttons and links
• browser_fill: Fill form fields
• browser_screenshot: Capture visual evidence
• document_vulnerability: Document confirmed findings
• create_poc: Generate proof-of-concept exploit scripts

​

Authentication Handling

• The agent automatically includes cookies and headers in all requests
• Authentication is preserved across HTTP requests and browser actions
• Session expiration is detected and reported

​

Related APIs